Limitations. This paper serves as preliminary work towards understanding the effectiveness of learning-based gradient inversion attacks, and our method can be further improved along several different directions.
1. For large models, our current approach is to hash the gradients into a lower-dimensional space to reduce memory cost. It may be possible to leverage the model's architecture to design more effective dimensionality reduction techniques to further scale up the method.
2. Currently we only focus on the setting with batch size 1, which precludes the use of secure aggregation [1]}—a common technique in FL for amplifying privacy by aggregating the gradients from multiple clients before revealing it to the server. For LTI, the complexity of MLP would increase when the batch size increases, which makes the learning harder. More advanced model architecture and loss design might help with the large batch case.
3. LTI in its current form does not leverage additional data priors such as the smoothness prior for images and text fluency prior for text. We can readily incorporate these priors by modifying the inversion model's loss function with total variation (for image data) or perplexity on a trained language model (for text data), which may further improve the performance of LTI.
